CVE-2021-27101
Accellion FTA SQL Injection Vulnerability
Description
CVE-2021-27101 is a critical-severity SQL injection vulnerability in Accellion FTA (File Transfer Appliance) version 9_12_370 and earlier. The flaw allows unauthenticated attackers to inject malicious SQL code via a crafted Host header in requests to the document_root.html endpoint, potentially enabling full database compromise and subsequent system access. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it has been linked to ransomware campaigns. This Accellion FTA SQL injection vulnerability served as the primary initial access vector in a coordinated attack campaign that also leveraged CVE-2021-27102, CVE-2021-27103, and CVE-2021-27104.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| accellion | fta | <= 9_12_370 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27101.txt(Broken Link, Third Party Advisory)
- https://www.accellion.com/products/fta/(Product, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27101(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL injection occurs when software constructs SQL commands using externally-influenced input without properly neutralizing special elements that could modify the intended query. In CVE-2021-27101, the Accellion FTA application incorporates the HTTP Host header value directly into a SQL query when processing requests to document_root.html, allowing attackers to inject arbitrary SQL statements that can read, modify, or delete database contents and potentially facilitate further system compromise.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2021-27101 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier, reflecting the maximum risk this vulnerability poses. The flaw is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker who can reach the FTA appliance. Successful SQL injection exploitation enables attackers to extract sensitive data from the FTA database, including credentials, file metadata, and configuration information. With confidentiality, integrity, and availability all rated HIGH, an attacker can read all stored data, manipulate database records, and disrupt file transfer services. The confirmed use in ransomware operations and EPSS score of 0.81% (74.1st percentile) underscore the real-world impact, as this vulnerability served as the initial foothold in attacks that resulted in massive data exfiltration from organizations worldwide.
Exploit Maturity
CVE-2021-27101 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and CISA has flagged it as used in ransomware campaigns. This SQL injection vulnerability served as the primary initial access vector in the high-profile Accellion FTA attack campaign of late 2020 and early 2021, where threat actors injected SQL through the Host header to gain database access and then chained this with CVE-2021-27102 (local command injection), CVE-2021-27103 (SSRF), and CVE-2021-27104 (remote command injection) to achieve full system compromise and data exfiltration. The EPSS score of 0.81% (74.1st percentile) reflects moderate exploitation probability in isolation, but the vulnerability's proven role as the entry point in a devastating attack chain makes it a confirmed critical threat. Federal agencies were required to remediate by 2021-11-17.
Remediation
- Upgrade Accellion FTA to version FTA_9_12_380 or later immediately as required by CISA KEV. Note that Accellion has end-of-lifed the FTA product and strongly recommends migration to Kiteworks as the permanent replacement.
- If immediate patching is not possible, take the Accellion FTA appliance offline to prevent SQL injection exploitation. Block external access to the document_root.html endpoint and implement web application firewall rules to detect and reject requests with manipulated Host headers.
- Deploy database activity monitoring on the FTA backend database to detect anomalous query patterns indicative of SQL injection attempts. Restrict database account privileges to the minimum necessary for FTA operations, preventing any injected queries from accessing system tables or executing administrative commands.
- Conduct a thorough forensic investigation of the FTA appliance database and file system. Review web server access logs for requests to document_root.html with unusual Host header values, check for unauthorized data access or exfiltration, and verify file integrity to identify any webshells or backdoors installed during exploitation.
- Migrate to a supported file transfer platform as Accellion FTA has reached end of life. Ensure the replacement solution uses parameterized queries (prepared statements) exclusively for all database operations to prevent SQL injection vulnerabilities.
Technical Details
CVE-2021-27101 is a SQL injection vulnerability in Accellion FTA version 9_12_370 and earlier, exploitable through a crafted Host header in HTTP requests to the document_root.html endpoint. The vulnerability exists because the FTA application incorporates the Host header value directly into SQL queries without using parameterized queries or properly sanitizing the input. An attacker can manipulate the Host header to inject arbitrary SQL statements that are executed against the backend database with the privileges of the application's database account. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the most dangerous exploitability profile: remotely accessible with no authentication, no user interaction, and low complexity, yielding maximum impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-27101 being actively exploited?
Yes. CVE-2021-27101 is listed in the CISA Known Exploited Vulnerabilities catalog and has been confirmed as used in ransomware campaigns. It served as the primary initial access vector in the widespread Accellion FTA attack campaign of 2020-2021, affecting numerous organizations globally.
What products are affected by CVE-2021-27101?
CVE-2021-27101 affects Accellion FTA (File Transfer Appliance) version 9_12_370 and all earlier versions. The fixed version is FTA_9_12_380 and later. The Accellion FTA product has reached end of life and migration to a supported platform is strongly recommended.
How do I fix CVE-2021-27101?
Upgrade to Accellion FTA version FTA_9_12_380 or later. Since the product has reached end of life, organizations should migrate to Kiteworks or another supported file transfer solution. Block access to document_root.html and deploy WAF rules to filter Host header manipulation as interim mitigations.
How severe is CVE-2021-27101?
CVE-2021-27101 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 74.1st percentile. As the initial access vector in a proven ransomware attack chain targeting Accellion FTA, this SQL injection vulnerability enabled data exfiltration campaigns affecting organizations across multiple sectors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.